This case study is written by Circle's Technical Operations team, based on Circle's experience using StepSecurity at scale

StepSecurity detects the axios npm supply chain attack in real-time in Backstage GitHub Actions workflow runs!

This case study discusses how StepSecurity Harden-Runner detected the compromised axios package making anomalous outbound connections to an attacker's C2 domain during routine GitHub Actions workflow runs in the Backstage repository. Key insights are:

• The compromised axios release injected a hidden dependency that deployed a cross-platform remote access trojan on install
• Harden-Runner flagged the C2 callback to the attacker's domain because it had never appeared in any prior workflow run
• Detection insights are publicly verifiable, enabling the Backstage team and the broader community to confirm the finding independently

StepSecurity detects the Trivy supply chain compromise across open-source GitHub Actions workflow runs in real-time!

This case study discusses how StepSecurity Harden-Runner detected the compromised trivy-action exfiltrating secrets to an attacker-controlled C2 domain across multiple open-source GitHub Actions workflow runs. Key insights are:

• The compromised action read GitHub Actions Runner memory to steal CI/CD secrets and exfiltrated them to a typosquatted domain
• Harden-Runner automatically flagged the anomalous outbound connections across affected projects including Kubernetes, Newrelic, and Grafana
• StepSecurity reported the impact to all affected community tier projects and helped the community assess and recover

StepSecurity detects a CI/CD supply chain attack on Microsoft’s Azure Karpenter Provider in real-time!

This case study discusses how StepSecurity Harden-Runner detected a CI/CD supply chain attack in real-time in Microsoft’s open-source project Azure Karpenter Provider. Key insights are:

• This could have compromised the cloud environment that the project had access to
• Within an hour of the exploit, StepSecurity reported the detection to the Microsoft Security Response Center (MSRC).
• Microsoft acknowledged StepSecurity for helping detect and remediate the incident

StepSecurity Detects CI/CD Supply Chain Attack in Google’s Open-Source Project Flank in real-time

This case study discusses how StepSecurity Harden-Runner detected a CI/CD supply chain attack in real-time in Google’s open-source project Flank. Key Insights are:

• This could have caused an XZ Utils and SolarWinds style software supply chain attack.
• The researcher exploited a Pwn Request Vulnerability to exfiltrate CI/CD credentials
• Harden-Runner detected this malicious outbound network call in real-time